secdev / scapy

Scapy: the Python-based interactive packet manipulation program & library.
https://scapy.net
GNU General Public License v2.0
10.68k stars 2.02k forks source link

Add NetflowHeaderV10 length computation #2544

Closed ivan-balan closed 4 years ago

ivan-balan commented 4 years ago

Brief description

class NetflowHeaderV10(Packet):
    """IPFix (Netflow V10) Header"""
    name = "IPFix (Netflow V10) Header"
    fields_desc = [
        ShortField("length", None, ),  #<<Causing issues as this this value remains unchanged
        UTCTimeField("ExportTime", 0),
        IntField("flowSequence", 0),
        IntField("ObservationDomainID", 0)
    ]

Environment

I`m not very experienced in Scapy, but as far as I my knowledge's go, it should be calculated during the post_build.

My guess:

class NetflowHeaderV10(Packet):
    """IPFix (Netflow V10) Header"""
    name = "IPFix (Netflow V10) Header"
    fields_desc = [
        ShortField("length", None, ),
        UTCTimeField("ExportTime", 0),
        IntField("flowSequence", 0),
        IntField("ObservationDomainID", 0)
    ]

    def post_build(self, pkt, pay):
        if self.length is None:
            length = len(pkt) + len(pay)
            pkt = struct.pack("!H", length) + pkt[2:]

        return pkt + pay

I tried it in a few examples, seem to work as expected.

Thanks for a great tool. Stay safe.

ivan-balan commented 4 years ago

Similar issue is with the Netflow v5

class NetflowHeaderV5(Packet):
    name = "Netflow Header v5"
    fields_desc = [ShortField("count", 0),  #<< no automatic handler for this value, causes issues if not set manually.
                   IntField("sysUptime", 0),
                   UTCTimeField("unixSecs", 0),
                   UTCTimeField("unixNanoSeconds", 0, use_nano=True),
                   IntField("flowSequence", 0),
                   ByteField("engineType", 0),
                   ByteField("engineID", 0),
                   ShortField("samplingInterval", 0)]
gpotter2 commented 4 years ago

Thanks for the report. Feel free to submit a PR